Authorization bypass in the @openclaw/voice-call package before version 2026.8.1 lets a remote caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) drive the agent's owner-only tools, because the caller's identity and non-owner status are not propagated on classic inbound voice calls. The owner-only tool filter therefore fails open, allowing data reads, file modification, command execution, or control of connected services depending on how the agent is provisioned. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 4.0 base 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis. Deployments with inbound calling disabled, or whose allowlist excludes the attacker, are not affected.
Authorization bypass in OpenClaw versions before 2026.8.1 lets an authenticated, low-privileged sender who is permitted to invoke skill commands reach owner-only tools and owner-reserved server credentials, because skill tool dispatch does not propagate the sender's owner status into the tool authorization decision. Exploitation requires only the PR:L prerequisite defined by the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, base 8.7) - no owner credentials and no user interaction - and yields high confidentiality and integrity impact with limited availability impact, so the practical exposure is confined to multi-sender or multi-tenant OpenClaw deployments in which non-owner principals have been granted skill-command access; single-owner or no-external-sender deployments are not exposed. No public exploit identified at time of analysis, and this CVE is not reported as confirmed actively exploited (CISA KEV); a vendor security advisory (GHSA-7cp7-87pj-p32v) and a VulnCheck advisory are available, and the fixed release is 2026.8.1.
An authenticated holder of an app-limited write API key on Capgo (capgo.app) can abuse the PUT /app/:id endpoint's user-controlled `icon` field to make a privileged service-role worker rewrite a private storage object belonging to another tenant, such as an organization logo, that the API key cannot read or write directly under Supabase Storage RLS. The flaw is a cross-tenant authorization bypass (CWE-639 / confused deputy) rather than remote code execution: the attacker cannot read the targeted object, cannot supply arbitrary replacement content beyond the referenced object being re-uploaded with cleaned metadata, and must already possess a scoped write API key for at least one app on the instance. Our independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N and considers the vendor's 8.7 (PR:N) rating materially overstated; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper authorization in Capgo App before 12.128.12 allows an authenticated organization member to mint a non-expiring, app-scoped API key even when the owning organization has enabled require_apikey_expiration and configured a max_apikey_expiration_days limit. The POST /apikey handler resolves the target app from the supplied app_id but omits the owning organization from the list passed to validateExpirationAgainstOrgPolicies when org_id, limited_to_orgs, and expires_at are absent, so the validation returns early and the expiration policy is silently skipped. Exploitation requires a valid org account with permission to create app-scoped keys and an organization that actually has the policy configured; the only privilege gained is indefinite key lifetime, and no public exploit code was identified at time of analysis. The vendor fixed the issue in version 12.128.12.
Stored cross-site scripting in SiYuan Note before v3.8.4 lets attacker-supplied flashcard block content run script inside the desktop client's privileged Electron renderer, which is created with nodeIntegration enabled and contextIsolation disabled, escalating the XSS to arbitrary code execution on the host. Per the independent assessment, exploitation is meaningfully gated: it requires the SiYuan desktop Electron client, an authenticated administrator account (the /api/riff/getRiffCards endpoint keeps its auth and admin-role checks), attacker-controlled flashcard content already planted in the workspace via import, contribution, or shared/synced documents, and the administrator actively opening the card manager view - so this is a targeted, condition-gated RCE risk rather than a broadly exploitable one, despite the 8.6 CVSS-4.0 headline. No public exploit code was identified at time of analysis and active exploitation is not confirmed; vendor fixes are available in v3.8.4.
SiYuan versions before 3.8.4 contain a cross-site scripting (XSS) flaw that allows attribute injection into gutter-button markup when a victim pastes attacker-controlled plain-text Markdown containing a Kramdown inline attribute list (IAL); on the Electron desktop build with Node integration enabled and context isolation disabled, this escalates to remote code execution with renderer Node.js privileges. Exploitation is unauthenticated (PR:N) but requires user interaction-the victim must paste the crafted Markdown and then focus the affected gutter control. No public exploit code has been identified at time of analysis, and the vendor has released a patch in v3.8.4.
Stored cross-site scripting in SiYuan versions 3.7.0 through 3.8.3 (fixed in 3.8.4) allows an authenticated user with write access to a shared workspace to plant JavaScript inside a database field description that is later rendered unescaped into an aria-label attribute of gallery and kanban (Attribute View) layouts. When the victim views that board in the SiYuan Electron desktop app - where nodeIntegration is enabled by default - the injected script reaches Node.js child_process APIs and can execute arbitrary commands with the victim's privileges, escalating a rendering flaw into full local code execution. Exploitation is access-gated: it requires an authenticated writer, the victim rendering the poisoned view, and the desktop Electron build, so real-world reach is narrower than the 8.6 CVSS 4.0 headline; no public exploit code or confirmed active exploitation was identified at time of analysis.
Vertical privilege escalation and account takeover in Capgo (capgo.app) through 12.261.0: an authenticated attacker who already holds the org_admin tier permission org.update_settings can rewrite the provider_id column of a public.sso_providers row over PostgREST and point the organization's email-domain trust anchor at an identity provider they control, after which the server-side SSO merge routine binds the attacker's identity to the legitimate org owner account, nulls that account's password, and deletes its other identities and sessions. The impact is full owner/super_admin takeover plus lockout of the real owner, although exploitation is gated on the target organization having an active SSO provider configured and on the attacker already possessing org_admin in that organization; no public exploit code was identified at time of analysis and there is no CISA KEV entry. The incomplete nature of the fix (a BEFORE UPDATE guard that freezes dns_verified_at, domain, status and enforce_sso but leaves provider_id, metadata_url and attribute_mapping writable under a table-wide ALL grant with only row-scoped RLS) makes this a durable privilege-escalation path rather than a one-off misconfiguration.
Session cookie theft in Grav CMS 2.0.19 through 2.0.24 lets an authenticated user with only page-write permission capture the session identifier of any administrator who views their published page, because the Twig sandbox exposes get_cookie() and the post-Twig page cache is keyed without any session or request dimension. The poisoned cache then serves the stolen identifier to unauthenticated visitors, who can replay the cookie to authenticate as the administrator, yielding full confidentiality, integrity and availability impact on the instance. Exploitation is confirmed against default configurations in 2.0.19-2.0.24 (security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() enables process.twig on every page), while 2.0.0-2.0.18 and 1.7.x are only affected if content Twig was explicitly enabled. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is Grav 2.0.25, and 1.7.x is outside the backport scope.
Command-execution approval bypass in the OpenClaw agent runtime (npm package 'openclaw') versions 2026.3.22 up to but not including 2026.8.1 lets an attacker piggyback on a previously approved command wrapper to run arbitrary commands with the OpenClaw process's host privileges, without triggering a new approval prompt; the vendor rates this 8.6 and our independent assessment places it at CVSS 3.1 8.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation is gated by two preconditions. An authenticated operator must first have allowlisted or permanently approved a specific wrapper invocation, and that wrapper (a transparent shell carrier, or an opaque utility such as a process monitor, tracer, namespace tool, or proxy wrapper) must resolve on the host; a later agent turn can then substitute an arbitrary inner command in the wrapper's arguments and have it executed under the host privileges of the OpenClaw process. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the issue is fully remediated by upgrading to 2026.8.1.
Command injection in OpenClaw versions before 2026.8.1 lets an attacker who can supply command input to an agent turn slip hidden commands past the exec allowlist: escaped newlines desynchronize the allowlist parser, which validates only the visible portion of the input while the appended command executes without the expected authorization prompt. Successful exploitation yields full code execution on the host (VC:H/VI:H/VA:H, CVSS 4.0 base 8.6; independently assessed as CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), though it requires the operator to be actively driving the affected agent turn (UI:P) and the attacker to already hold a low-privilege position on the command-input surface (PR:L). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the allowlist-bypass nature of the bug means any environment relying on the exec allowlist as its execution boundary should treat this as high priority.
Authenticated users holding the builder role in Budibase Server deployments before 3.45.0 can read arbitrary files from the host by submitting an OpenAPI/Swagger specification containing file:// external references to the data-source import endpoint, because the import validator never disables external JSON reference ($ref) resolution. Disclosed files include .env content and other configuration material holding JWT signing secrets, API keys and database credentials, so a read-only confidentiality bug can chain into full session forgery and downstream access to connected systems. Both the NVD-style CVSS 4.0 vector and our independent CVSS 3.1 assessment (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) require a valid builder-level account; there is no public exploit code identified at time of analysis and the CVE is not in CISA KEV, so exposure is bounded by how loosely builder accounts are provisioned - severe in shared or multi-tenant instances, lower in single-tenant deployments where builder seats are tightly held.
Authenticated privilege escalation in Budibase Server before 3.45.0 lets a low-privileged 'builder' account grant itself administrative roles in other workspaces. The flaw resides in the POST /api/global/groups/:groupId/apps endpoint, which fails to validate per-app authorization, allowing a builder who only has rights in one workspace to rewrite user-group role mappings for applications outside their own tenant boundary. Because the CVSS vector requires PR:L and no user interaction, exploitation is limited to authenticated builders, and a single-workspace or single-tenant instance offers no cross-boundary target; the raw 8.6 score therefore overstates the immediate threat even though the underlying authorization defect and its escalation impact are genuine. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though a vendor patch is available in 3.45.0.
SiYuan versions up to and including 3.8.3 contain an authentication bypass allowing a remote attacker to execute arbitrary script in the SiYuan origin and invoke administrator APIs by tricking a victim into visiting a malicious web page. The vulnerability is unauthenticated (CVSS PR:N) but requires user interaction (UI:P); password-protected instances are only affected if the victim has a live session. No public exploit code was identified at the time of analysis, and the issue is fixed in version 3.8.4.
Authorization bypass in the npm package `openclaw` (OpenClaw) before version 2026.7.1 allows an already-authorized non-owner channel sender who holds channel command access to approve or deny Claude Code permission prompts that were meant for the owner, causing the pending action to proceed without owner consent. The severity of any given exploitation is bounded by what the specific Claude Code run requested - the attacker can only green-light capabilities the host run had already queued, so impact ranges from low-risk operations up to high-impact host actions depending on context. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited; the vendor-released fix is version 2026.7.1.
SiYuan note-taking versions before v3.8.4 leak native clipboard data to attacker-influenced content rendered by a remote-kernel renderer because the siyuan-get IPC handler omits an authorization check on the clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands. When a victim performs a user-mediated paste into that renderer content, those commands are invoked with matching plaintext and return native clipboard formats, disclosing whatever MathML formulas, Office bytes, or WPS bytes happened to be on the local clipboard at that instant. There is no public exploit identified at time of analysis, exploitation is local and interaction-dependent, and the exposure is limited to clipboard contents present at the moment of the paste - so the vendor CVSS 4.0 score of 8.6 (HIGH), our independent assessment treats this as a bounded information-disclosure issue rather than a high-severity compromise.
Case-sensitivity bypass in Hugo's security.http.urls IP-literal deny rule lets builds running v0.162.0 through v0.165.x fetch URLs that the rule was configured to block - a mixed-case scheme such as 'HTTP://localhost/...' evades the deny match, re-enabling SSRF through resources.GetRemote. The issue is unauthenticated (PR:N) but local (AV:L): it only matters when a Hugo build processes attacker-influenced input and the operator depends on the IP-literal deny rule as the SSRF control, and it cannot be triggered against an already-served static site. No public exploit code has been identified and there is no confirmation of active exploitation, but a vendor patch is available in Hugo v0.166.0.
Stored cross-site scripting in SiYuan before v3.8.4 allows an authenticated attacker with write access to Attribute View content to persist JavaScript in four unsanitized textarea-backed fields - field descriptions, template sources, select option descriptions, and footer calculation templates - which then executes in the browser session of any user who opens the affected database menu. The desktop Electron build escalates the issue to command execution with SiYuan process privileges when nodeIntegration is enabled, while browser or hardened Electron deployments cap impact at script execution in the victim's session. Vendor-released patch: v3.8.4; no public exploit identified at time of analysis, and the vendor/GHSA advisory plus a VulnCheck advisory are the primary references. CVSS 4.0 base score is 8.5; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, consistent with a genuine but conditionally-gated stored XSS whose RCE escalation depends on the nodeIntegration setting.
Arbitrary file deletion in Froxlor through 2.3.10 lets an authenticated customer account with write access to an FTP home directory plant a symlink that a root cron job later follows, recursively deleting arbitrary directory trees. The flaw is a TOCTOU race: the deleteFtpData cron task (task 8) runs FileDir::makeCorrectDir() without the $fixed_homedir argument, skipping symlink validation before executing 'rm -rf' as root on a trailing-slash path that GNU rm dereferences. Exploitation requires valid low-privilege credentials and winning the timing window between task insertion and cron execution; no public exploit identified at time of analysis. Impact is deletion-only but can cross tenant boundaries and cause host denial of service on multi-tenant hosting deployments.
Sensitive-path guard bypass in SiYuan 3.8.0 through 3.8.3 lets an authenticated administrator reach files that the protected-workspace denylist is designed to exclude by invoking recursive MCP file operations against a permitted root: file.grep can return matching lines from non-hidden protected descendants such as conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, and the kernel log, while file.copy can stage those descendants to an ordinary path for a follow-on file.read and unzip can overwrite them using lexically contained ZIP member names. The defect is an incomplete fix for GHSA-c8r8-95hg-mp34 that was addressed in SiYuan 3.8.4, and no public exploit code was identified at the time of analysis. Because administrative authentication (PR:H) is mandatory and SiYuan is typically a single-user, self-hosted tool where the admin is the sole operator, real-world risk is materially constrained, though prompt injection into the in-app Agent is the practical amplifier since file.grep is globally classified as a safe action and therefore receives no per-call confirmation.
Authenticated low-privilege Froxlor users with subdomain-create rights can inject arbitrary nginx or Apache configuration directives via CRLF sequences in the userinfo component of a subdomain redirect URL, leading to server-wide response hijacking and local file disclosure. The vulnerability affects versions 0 through 2.3.10 (incompletely fixed) and up to version 2.3.12, which contains the complete fix. The independent assessment rates this as a genuine high-priority vulnerability; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw npm package versions 2026.3.28 through 2026.8.0 can be coerced into executing attacker-supplied Python code when an operator opens OpenClaw against an untrusted workspace whose .env file sets CLOUDSDK_PYTHON_ARGS and then runs the Gmail setup flow. The poisoned value is inherited by the gcloud launcher, which forwards it as arguments to the trusted Python interpreter, giving the attacker code execution with the OpenClaw host user's permissions - enough to read credentials, modify files, or spawn further processes. The issue is rated 8.5 (CVSS 4.0 AV:L/AC:L/AT:N/PR:N/UI:P; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is fully local and interaction-dependent: the malicious workspace content must already be present and the operator must both launch OpenClaw on it and actively trigger Gmail setup, so it cannot be fired remotely or unattended; no public exploit code was identified at time of analysis. Version 2026.8.1 fixes the flaw.
Stored cross-site scripting in the Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 allows an unauthenticated visitor to plant an HTML/JavaScript payload through a front-end form whose submissions are written into the user/data store; that payload is later rendered unescaped in the classic admin panel's item-detail view and executes in the administrator's browser session and origin, with access to that administrator's privileges and CSRF token. Exploitation requires a specific but realistic configuration chain: the site must route front-end form submissions into user/data, and the administrator must open the malicious entry in the classic Grav admin panel - sites running the Grav 2.0 Admin Next interface are not affected because it renders the same data through a separate, correctly escaping code path. The initial injection is unauthenticated (CVSS PR:N), while the privilege-boundary crossing needs administrator interaction (UI:R); payloads in list-type values such as checkboxes or multi-selects fire on view with no further interaction, whereas ordinary text fields fire on hover. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in Data Manager 1.4.5.
Path traversal in SiYuan's exportBrowserHTML endpoint lets an authenticated administrator write attacker-controlled HTML into an index.html file outside the workspace directory, affecting all releases before v3.8.4. By supplying a folder parameter containing traversal sequences (such as ../../), an attacker with administrator privileges can overwrite any pre-existing, kernel-writable index.html location, achieving stored cross-site scripting or defacing the workspace. The issue is rated 8.3 (CVSS 4.0) with high integrity impact and low availability impact, requires high privileges (PR:H) and no user interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to v3.8.4 resolves it.
Authenticated path traversal in SiYuan before v3.8.4 enables an administrator to write arbitrary files and create directory trees outside the workspace boundary via the setNotebookIcon endpoint. By injecting ../ sequences in the notebook parameter, the kernel process can write conf.json and other files to any location the process account can access. Exploitation requires a valid administrator session, so the realistic threat is a malicious or compromised admin rather than an anonymous remote attacker; no public exploit code has been identified, and CISA KEV does not list this issue.
Path traversal in the checkoutRepo endpoint of SiYuan (siyuan-note:siyuan) before v3.8.4 lets an authenticated administrator supply a sessionID parameter containing ../ sequences and overwrite JSON files in pre-existing directories that the SiYuan kernel can already write to, including locations outside the workspace. Integrity impact is high (CVSS 4.0 base 8.3; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) but there is no confidentiality impact, no ability to create new files or write non-JSON content, and the PR:H requirement confines realistic abuse to a rogue or compromised administrator rather than an opportunistic remote attacker. No public exploit identified at time of analysis, and the issue is assessed as a moderate, not top-tier, priority.
Cross-namespace information disclosure in Kyverno before 1.19.1 allows an authenticated low-privilege tenant to read resources from other namespaces by abusing the apiCall context entry in namespaced Policy resources. The attacker crafts percent-encoded dot-segments in urlPath so that Kyverno's validation and execution stages interpret the path inconsistently, ultimately using the admission controller's ServiceAccount credentials to fetch data across the namespace boundary. Exploitation requires the ability to create or modify namespaced Policy resources and a multi-tenant deployment where namespace isolation is the security boundary; no public exploit identified at time of analysis, and a vendor patch is available in Kyverno 1.19.1.
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, letting remote attackers reach the plugin's vulnerable request handlers and inject arbitrary SQL into backend database queries; the vendor-assigned CVSS 4.0 vector (8.3, AV:N/AC:L/AT:P/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) both describe a network-reachable, no-authentication, no-user-interaction flaw capable of returning or altering stored data. Only Joomla sites that actually have this third-party extension installed and expose the affected endpoint are in scope, and the plugin's comparatively small install base limits the overall attack surface; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Successful exploitation depends on the injectable feature being reachable in the target deployment, which is why the CVSS 4.0 vector carries the AT:P attack-requirement flag.
Pinned vLLM deployments (0.22.1 through 0.28.0) running the FunAudioChat or Tarsier2 architectures silently ignore the operator's --revision/--code-revision pin for several Hugging Face artifacts, allowing a subsequent change to the upstream repository's default branch to alter audio preprocessing, speech-tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. The result is a supply-chain integrity and reproducibility failure rather than a code-execution flaw: the advisory explicitly states it is residual to CVE-2026-47155 / GHSA-3ww4-5jv9-j5gm and does not constitute remote code execution or a trust_remote_code=False bypass, despite an 'RCE' tag appearing in some threat-feed metadata. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires the narrow combination of an affected architecture, an operator using a revision pin, and an actor able to modify the upstream Hugging Face repository's default revision, so default general-purpose vLLM deployments are unaffected.
Unauthenticated arbitrary file deletion in the AcyMailing Enterprise extension for Joomla (versions before 11.1.0) allows a remote attacker to store an arbitrary filesystem path - including paths that traverse outside the configured upload directory, such as configuration.php - in a file-type custom field and have the extension delete that file when the field is subsequently cleared. Exploitation requires a publicly reachable subscription or profile form that has a file-type custom field configured, so a default installation without such a field is not affected; the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) confirms network reachability, low complexity, no privileges required and no user interaction, with high integrity and availability impact but no confidentiality impact, reflecting a purely destructive outcome rather than data theft. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released a fixed version.
MFA enforcement in Stoatchat before 0.15.5 can be bypassed by an attacker who already holds the victim's password, because the platform applies rate limiting only per source IP to TOTP challenges and allows a single MFA challenge ticket to be reused across repeated failed attempts. By rotating source addresses, an attacker can guess the TOTP code essentially without an account-level attempt limit and gain full account access; exploitation requires that MFA is enabled on the target account, and no public exploit code has been identified at time of analysis.
Cross-namespace information disclosure in Kyverno 1.16.0 through 1.19.0 lets an authenticated tenant with RBAC permission to create namespaced policy objects read the full cached contents of cluster-scoped GlobalContextEntry resources - including data from namespaces they have no RBAC access to - by invoking globalContext.get() in a CEL policy. The root cause is that the globalcontext.Lib CEL library is registered in the policy environment without the namespace confinement applied to its sibling libraries (resource.Lib, http.Lib, configMap loader), and no admission validation blocks the call. Exploitation requires a multi-tenant cluster with a GlobalContextEntry configured and caching data the tenant cannot otherwise read, so the blast radius is bounded by those preconditions and the flaw is inert on single-tenant clusters or clusters with no GlobalContextEntry; no public exploit identified at time of analysis, and the issue is fixed in Kyverno 1.19.1.
Broken workspace-level authorization in the Budibase server component before 3.45.0 allows an authenticated user holding builder access to a single workspace to enumerate chat identity link records belonging to every other workspace in the same tenant via a GET request to /api/chat-links. Exploitation discloses user IDs and external chat service identifiers for workspaces the builder is not permitted to access, but is read-only with no integrity or availability impact and no cross-tenant reach. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the real-world exposure is an insider or multi-workspace-tenant risk rather than an internet-wide threat.
Server-side request forgery in Kyverno before 1.19.1 lets a user who can author a ClusterPolicy or GlobalContextEntry with a non-CEL context[].apiCall.service call force the admission controller to issue GET/POST requests to an arbitrary destination, including cloud metadata endpoints, loopback, and any in-cluster service, thereby reading cloud instance credentials and reaching internal endpoints from Kyverno's network position. The vulnerable legacy executor and the GlobalContextEntry external-API path use a plain net/http client with no egress blocklist and no validation of the configured service URL, and they unconditionally attach Kyverno's projected ServiceAccount token to the attacker-chosen destination (the token is audience-scoped, limiting replay value). Exploitation requires high privileges because the attacker must already be able to write cluster-scoped policy objects (PR:H); the bar drops to a lower-privileged resource submitter only in the non-default case where a deployed policy templates the service URL from the admission resource. There is no public exploit identified at time of analysis, and the vendor rates the issue 8.3 (High) under CVSS 4.0.
Kyverno 1.14.0 through 1.19.0 fail open in a way that lets unsigned or untrusted container images be admitted to a Kubernetes cluster: the ImageValidatingPolicy evaluator silently ignores the spec.images and spec.allowedValues fields of a PolicyException, so any exception whose policyRefs and matchConditions match a resource disables image signature verification for that entire resource rather than only for the named images or values. An authenticated user with Kubernetes API rights sufficient to deploy or modify workloads covered by such an exception (CVSS PR:L) can therefore bypass signature enforcement without obtaining any new privileges - the flaw simply turns a narrow, trust-anchored carve-out into a blanket exemption. No public exploit code identified at time of analysis, and the vendor has released a fix in Kyverno 1.19.1; scope is limited to clusters that actively enforce signature verification through ImageValidatingPolicy and define matching PolicyExceptions.
Out-of-vocabulary stop_token_ids in vLLM 0.22.0 through 0.23.0 cause a CUDA tensor indexing failure that drives EngineCore into a fatal state and forces a manual service restart. The trigger is a generation request that simultaneously sets min_tokens greater than zero and includes stop_token_ids outside the model's vocabulary bounds, slipping past missing validation in the Rust HTTP and gRPC frontends to reach MinTokensLogitsProcessor; CVSS 4.0 scores this 8.2, but the assessed impact is availability-only (C:N/I:N/A:H) and deployments enabling vLLM's optional API-key authentication would require a valid key, so real-world severity is lower than the headline score. No public exploit code or confirmed active exploitation is identified at time of analysis (not in CISA KEV), and a vendor patch is available per advisory GHSA-qff2-492f-9fm4, with ENISA EUVD-2026-87746 recording the affected range as 0.22.0 up to but not including 0.24.0.
Authentication bypass in the SiYuan note-taking and knowledge-management publish service affects all releases before v3.8.4: session cookies for the publish feature are issued without the Secure or SameSite attributes and are transmitted over plaintext HTTP, so an on-path attacker can observe the publish-visitor-session-id cookie during a legitimate Basic Auth exchange and replay it against authenticated publish endpoints without knowing the account password. Exploitation requires the publish service to be enabled and protected by Basic Auth, the service to be reachable over cleartext HTTP rather than HTTPS, and the attacker to hold a man-in-the-middle network position (attack requirements: present in the CVSS 4.0 vector); serving the service over TLS removes the exposure entirely. No public exploit code was identified at time of analysis and there is no CISA KEV entry; the independent assessment rates this CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, a confidentiality-only impact, making it a genuine but conditionally exploitable bypass rather than an unconditionally high-risk flaw.
Stack exhaustion in Nodemailer before 10.0.2 allows unauthenticated remote attackers to crash an affected Node.js process by supplying a deeply nested JSON array in a recipient field (to, cc, or bcc) that the library flattens recursively until the call stack is exhausted. The flaw is only reachable through a host application that accepts externally controlled recipient input and passes it into Nodemailer message options without validating or bounding array nesting depth, so real-world impact is a recoverable denial of service with no data exposure or code execution. No KEV listing, EPSS signal, or public exploit code was identified at time of analysis, and the vendor has released a patched version (10.0.2); the issue is tracked as EUVD-2026-87675 and GHSA-8vvx-rff5-p5rq.
Server-side request forgery in OpenClaw (npm package 'openclaw') before 2026.8.1 lets an attacker who can influence DNS for an already-allowlisted hostname bypass the trusted-host destination validation and reach a service bound only to loopback, disclosing that service's response. Exploitation is highly conditional and high-complexity: the fetch must go through the trusted-host DNS recheck path, the hostname must already be on the trusted-host allowlist, the attacker must be able to make it resolve to an unspecified address (0.0.0.0 or ::), and a loopback-bound service must actually exist and return useful data - impact is confidentiality-only. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor shipped a fix in 2026.8.1.
Authorization bypass in OpenClaw before 2026.8.1 lets an attacker reuse an already-approved executable with different arguments, so commands execute without a new approval prompt. The root of the flaw is that 'Allow Always' approvals granted for an exact command are persisted on macOS and Linux as path-only grants, meaning any later invocation of that same binary silently inherits the earlier approval. Exploitation is conditionally gated: an operator must first have granted Allow Always for at least one command, and the attacker must then steer the agent into invoking that binary with attacker-chosen arguments (typically via prompt or content injection), which is reflected in the high attack complexity and user-interaction metrics of the assessed vector rather than a pre-auth internet-facing entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
OpenClaw (npm package 'openclaw') versions before 2026.8.1 leak deterministic hashes computed over the original, unredacted configuration inside responses to redacted configuration requests, so a caller who can invoke operations such as config.get can perform offline password-candidate testing instead of going through the rate-limited Gateway authentication endpoint. Exploitation is conditional: the attacker must already hold an authenticated, low-privileged session able to retrieve the redacted config, the Gateway password must have low entropy, and the remaining non-redacted configuration values must be reconstructable enough to compute candidate hashes - high-entropy passwords defeat the attack entirely and secret references are not exposed by the flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and recovery of the password would grant the documented shared-secret operator authority, which explains the High confidentiality, integrity and availability impact rating.
Authorization bypass in OpenClaw's Matrix integration (@openclaw/matrix) allows an authenticated Matrix participant to inherit another account's authority when their user identifier collides after case/Unicode folding. Versions 2026.2.2 through 2026.8.0 lowercase the complete Matrix user ID - including the case-sensitive server-name portion and historical localparts - before deriving the OpenClaw authorization identity, so an attacker controlling a protocol-valid, fold-equivalent identifier (display-name matching is not required) can gain allowlist, owner-command, exec-approval, or plugin-approval rights configured for the privileged account. The vendor rates this CVSS 7.7 with high confidentiality, integrity, and availability impact; real-world risk is moderate and gated by the attacker needing a valid authenticated Matrix account plus a registrable colliding identifier, and no public exploit identified at time of analysis.
Missing authorization in Flowise through 3.1.4 allows any authenticated low-privilege user or holder of a valid API key to read or delete document-store upsert history records belonging to other users or workspaces by supplying a known chatflowId or record UUIDs. The chatflowId is exposed in public /chatbot/<chatflowId> share links, materially lowering the barrier, but the independent assessment limits practical impact to high confidentiality and low integrity with no availability impact and no code execution. No public exploit was identified at time of analysis, and no vendor-released patch is available.
Privilege escalation in the OpenClaw npm package (versions >= 2026.4.5 and < 2026.8.1) allows a restricted external sender to have its session-derived text persisted into shared session memory and later replayed to an unattended background 'dreaming' agent that holds broader file and command privileges, producing actions beyond the authority of the original turn. The flaw is only reachable in deployments where session-memory capture and the dreaming agent are both enabled and the background agent is provisioned with more capability than the originating turn, and the exploit chain additionally depends on the content being selected for later processing and then actually followed by the model. No public exploit identified at time of analysis; vendor has released a fix in OpenClaw 2026.8.1, and the vendor-assigned CVSS 4.0 score is 7.7.
Second-factor bypass in Froxlor through 2.3.10 allows an attacker who already knows a target administrator's password to defeat the administrator's TOTP protection and obtain a full authenticated admin session. The flaw is rooted in remembered-2FA tokens (panel_2fa_tokens) storing only a bare numeric user ID with no account-type namespace; because customer and administrator IDs are drawn from separate sequences, a remembered-2FA cookie issued to a customer can satisfy the login-time token lookup for an administrator with the same numeric ID, which is not constrained by account type. Exploitation is chained and targeted: it requires prior password compromise, control of a customer account whose ID collides with the target admin, and a live remembered-2FA cookie, so this is not a default-config remote takeover; no public exploit code was identified at time of analysis, and the issue is fixed in 2.3.12 (per the CVSS 4.0 vector, PR:L).
Cross-tenant credential theft in Flowise through 3.1.4 allows an authenticated user on a multi-workspace instance to make the server decrypt and use another workspace's OpenAI or ElevenLabs API key by supplying that workspace's credential UUID to affected endpoints. The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key), requires a valid account plus knowledge of the target credential UUID, and independent assessment treats it as a genuine but moderate-priority cross-tenant access-control issue rather than a headline emergency. The supplied CVSS:4.0 score is 7.6; no vendor-released patch was identified at the time of publication, and no public exploit was identified at time of analysis.
Incorrect authorization in OpenClaw Feishu before 2026.8.1 allows an authenticated attacker who can already invoke the agent's model tool operations to act through a default account that the operator has disabled, because the account-selection logic never checks the disabled flag before using that account's still-stored Feishu credentials. Successful exploitation lets the attacker read or modify Feishu resources under a revoked identity, yielding high confidentiality and integrity impact (CVSS 4.0 base 7.6; assessed CVSS 3.1 7.6 with AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:N by our analysis). Exploitation is conditional and non-default: it requires a multi-account configuration where the default account is disabled yet its credentials remain valid, plus pre-existing low-privilege access to the OpenClaw agent, so it is not reachable by an anonymous remote attacker against a default install; no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Flowise through 3.1.4 omits route-level RBAC enforcement on its chat message endpoints, so an authenticated holder of a low-privileged API key that lacks the required flow permissions can read chat histories, prompts and model responses, and can delete chat messages, via the GET and DELETE chat message routes. The flaw is real but moderate priority: it requires a valid under-privileged API key (CVSS vector PR:L, i.e. authenticated) and mainly matters in multi-user or multi-tenant deployments that issue keys to lower-trust parties - single-operator setups where one trusted party holds all keys face negligible practical risk. Impact is confined to confidentiality and integrity of chat data (no code execution, no availability loss); no public exploit code and no confirmed active exploitation were identified at time of analysis.
OpenClaw (npm package openclaw) before 2026.7.1 misbinds Signal approval reactions to the wrong message, so a reaction an approver places on ordinary outbound text can be interpreted as approving or denying a structured host-action request that happens to be pending in the same conversation. Exploitation requires an authenticated participant acting as approver (PR:L), deliberate user interaction via a reaction (UI:P), and precise timing where unrelated outbound messages and a pending approval coexist (AC:H, AT:P), which is why the CVSS 4.0 base score is 7.5 rather than critical. The flaw does not grant any party new authority and does not change the legitimacy of correctly identified approvers; impact is bounded by whatever host actions the OpenClaw process is authorized to perform for the specific pending request. Vendor-released patch: 2026.7.1; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Authorization scope widening in OpenClaw before 2026.8.1 allows an authenticated low-privilege sender to reuse a standing 'allow-always' file-transfer approval and reach file paths or nodes that the operator never reviewed, resulting in unauthorized file read and write (C:H/I:H, no availability impact) within whatever the agent's file-transfer capability can touch. Exploitation is conditional: it requires a previously granted allow-always approval, an already-admitted sender who can steer the agent (PR:L/UI:P), and successful abuse of glob metacharacter interpretation or node display-name reuse to resolve the grant to sibling paths or a different node (AC:H/AT:P), so it is not reliably automatable and there is no prior grant to widen otherwise. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; a vendor patch is available in OpenClaw 2026.8.1.